Re: [Dime] Secdir last call review of draft-ietf-dime-group-signaling-13

[Marco Liebsch <[e-mail]>]

Thanks, Catherine, for the review.

marco

-----Original Message-----
From: Catherine Meadows via Datatracker <[e-mail]>
Sent: Dienstag, 26. Januar 2021 17:56
To: [e-mail]
Cc: [e-mail]; [e-mail]; 
[e-mail]
Subject: Secdir last call review of draft-ietf-dime-group-signaling-13

Reviewer: Catherine Meadows
Review result: Ready

I have reviewed this document as part of the security directorate's ongoing 
effort to review all IETF documents being processed by the IESG.  These 
comments were written primarily for the benefit of the security area 
directors. Document editors and WG chairs should treat these comments just 
like any other  last call comments.

This draft presents the commands a Diameter node could use to communicate with 
multiple sessions of the Diameter simultaneously.  The Security Considerations 
section mentions two issues.  One is that the use of bulk commands introduces 
increases the ease of implementing certain types of DoS attacks  because a 
single command, e.g. to terminate a session, could affect multiple sessions 
instead of just one.  The other is that current  security mechanisms employed 
by Diameter do not enforce end-to-end security, and so make it difficult to 
trust information received from non-adjacent nodes.  Work is ongoing on 
end-to-end security for Diameter, so it is premature to address end-to-end 
security in this document, which instead relies on available security 
mechanisms.

I think this is a reasonable summary of the security considerations.  Since 
end-to-end security for Diameter is a work in progress, it would be premature 
to attempt to address it in this document.  I consider this document Ready.